Vaultwarden Setup: Self-Hosted Password Manager

Vaultwarden is a lightweight, community-supported alternative to the official Bitwarden server, written in Rust. Compared to the official Bitwarden server, it consumes far fewer resources and is fully compatible with all Bitwarden clients (web, desktop, mobile, browser extension). By hosting it on your own server, you retain complete control over your passwords.

What is Vaultwarden?

Vaultwarden (formerly bitwarden_rs) is an open-source project that reimplements the Bitwarden API in Rust. Key features:

Low Resource Usage: Runs comfortably with 512 MB RAM
Bitwarden Compatibility: All official Bitwarden clients are supported
Organization Support: Create organizations and collections for free
TOTP Support: Two-factor authentication
Web Vault: Browser-accessible web interface
Send Feature: Secure file and text sharing

System Requirements

Server with Docker and Docker Compose installed
Minimum 512 MB RAM
Valid domain name (required for HTTPS)
SSL certificate (Let's Encrypt recommended)

Installation with Docker

Creating docker-compose.yml

hljs yaml

version: '3.8'

services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: unless-stopped
    environment:
      DOMAIN: "https://vault.example.com"
      SIGNUPS_ALLOWED: "true"
      ADMIN_TOKEN: "strong-admin-token-here"
      WEBSOCKET_ENABLED: "true"
      LOG_LEVEL: "warn"
    volumes:
      - ./vw-data:/data
    ports:
      - "127.0.0.1:8080:80"
      - "127.0.0.1:3012:3012"

hljs bash

# Start the container
docker compose up -d

# Check logs
docker logs vaultwarden -f

Use a strong and random value for ADMIN_TOKEN. You can generate a secure token with openssl rand -base64 48.

Generating Admin Token

hljs bash

# Generate secure admin token
openssl rand -base64 48

# More secure token with Argon2 hash (recommended)
docker run --rm -it vaultwarden/server /vaultwarden hash --preset owasp

Nginx Reverse Proxy and SSL Configuration

Since Vaultwarden requires HTTPS, setting up an Nginx reverse proxy is mandatory.

Nginx Configuration

hljs nginx

server {
    listen 80;
    server_name vault.example.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    server_name vault.example.com;

    ssl_certificate /etc/letsencrypt/live/vault.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/vault.example.com/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;

    client_max_body_size 128M;

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    location /notifications/hub {
        proxy_pass http://127.0.0.1:3012;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }

    location /notifications/hub/negotiate {
        proxy_pass http://127.0.0.1:8080;
    }
}

Let's Encrypt SSL Certificate

hljs bash

# Install Certbot
apt install certbot python3-certbot-nginx -y

# Obtain SSL certificate
certbot --nginx -d vault.example.com

# Test automatic renewal
certbot renew --dry-run

Admin Panel Configuration

Access the admin panel at https://vault.example.com/admin.

Important Admin Settings

hljs bash

# Disable registration after setup
SIGNUPS_ALLOWED=false

# Allow registration only for specific domains
SIGNUPS_DOMAINS_WHITELIST=example.com,company.org

# Invitation system
INVITATIONS_ALLOWED=true

# Email verification
SIGNUPS_VERIFY=true

SMTP Email Configuration

hljs yaml

environment:
  SMTP_HOST: "smtp.gmail.com"
  SMTP_FROM: "vault@example.com"
  SMTP_PORT: "587"
  SMTP_SECURITY: "starttls"
  SMTP_USERNAME: "vault@example.com"
  SMTP_PASSWORD: "app-password"

User Management

Inviting Users

From the admin panel, go to Users → Invite User to send email invitations.

hljs bash

# Invite user via CLI
docker exec vaultwarden /vaultwarden invite --email user@example.com

Creating Organizations and Collections

Organizations are free in Vaultwarden (paid in official Bitwarden):

Log in to the web vault
Organizations → New Organization
Enter organization name and billing email
Use Collections to categorize passwords
Invite members and assign roles (Admin, Manager, User, Custom)

Connecting Bitwarden Clients

Browser Extension

Install the Bitwarden extension (Chrome, Firefox, Edge)
Click Server URL on the login screen
Enter https://vault.example.com
Log in with your account

Mobile App

1. Open the Bitwarden app
2. Tap the region selector on the login screen
3. Select "Self-hosted"
4. Server URL: https://vault.example.com
5. Save and log in

Desktop App

File → Settings → Server URL
https://vault.example.com

Backup

hljs bash

# Backup Vaultwarden data
tar -czf vaultwarden-backup-$(date +%Y%m%d).tar.gz ./vw-data/

# Automated backup script
cat > /etc/cron.daily/vaultwarden-backup << 'EOF'
#!/bin/bash
BACKUP_DIR="/backups/vaultwarden"
mkdir -p $BACKUP_DIR
tar -czf $BACKUP_DIR/backup-$(date +%Y%m%d-%H%M%S).tar.gz /opt/vaultwarden/vw-data/
# Delete backups older than 30 days
find $BACKUP_DIR -name "backup-*.tar.gz" -mtime +30 -delete
EOF
chmod +x /etc/cron.daily/vaultwarden-backup

Vaultwarden runs great on REXE VPS servers. 1 GB RAM and 1 vCPU is sufficient for small teams.

Vaultwarden Setup: Self-Hosted Password Manager

Table of Contents